Protection of a computer or data network from undesired and unauthorized data disclosure, interception or alteration has been a perennial concern in the field of computer and network security. For example, firewall and anti-spyware software have been developed to address security concerns for computers and networks connected to the Internet and to protect them from possible cyberattacks such as Trojan horse-type viruses or worms that may trigger undesired and unauthorized data disclosure by these computers and networks. However, for high security computer networks such as those used by government agencies and intelligence communities and certain commercial applications, conventional network security devices such as firewalls may not provide sufficiently reliable protection from undesired data disclosure.
Alternative network security methods and devices based on unidirectional data transfer have been devised to address the network security concern. For example, U.S. Pat. No. 5,703,562 to Nilsen (“the '562 patent”), the content of which is hereby incorporated by reference in its entirety, provides an alternative way to address the network security concern. The '562 patent discloses a method of transferring data from an unsecured computer to a secured computer over a one-way optical data link comprising an optical transmitter on the sending side and an optical receiver on the receiving side. By providing such an inherently unidirectional data link to a computer/data network to be protected, one can eliminate any possibility of unintended data leakage out of the computer/data network over the same link.
One-way data transfer systems based on such one-way data links provide network security to data networks by isolating the networks from potential security breaches (i.e., undesired and unauthorized data flow out of the secure network) while still allowing them to import data from the external source in a controlled fashion. FIG. 1 schematically illustrates an example of one such one-way data transfer system 100. In the one-way data transfer system shown in FIG. 1, two computing platforms (or nodes) 101 and 102 (respectively, “the Send Node” and “the Receive Node”) are connected to the unsecured external network 104 (“the source network”) and the secure network 105 (“the destination network”), respectively. The Send Node 101 is connected to the Receive Node 102 by a one-way data link 103, which may be an optical link comprising, for example, a high-bandwidth optical fiber. This one-way optical data link 103 may be configured to operate as a unidirectional data gateway from the source network 104 to the secure destination network 105 by having its ends connected to an optical transmitter on the Send Node and to an optical receiver on the Receive Node.
This configuration physically enforces one-way data transfer at both ends of the optical fiber connecting the Send Node 101 to the Receive Node 102, thereby creating a truly unidirectional one-way data link between the source network 104 and the destination network 105 shown in FIG. 1. Unlike the conventional firewalls, one-way data transfer systems based on a one-way data link are designed to transfer data or information only in one direction and it is physically impossible to transfer data or information of any kind in the reverse direction. No information or data of any kind, including handshaking protocols such as those used in data transport protocols such as TCP/IP, SCSI, USB, Serial/Parallel Ports, etc., can travel in the reverse direction from the Receive Node back to the Send Node across the one-way data link. Such physically imposed unidirectionality in data flow cannot be hacked by a programmer, as is often done with firewalls. Accordingly, the one-way data transfer system based on a one-way data link ensures that data residing on the isolated secure computer or network is maximally protected from any undesired and unauthorized disclosure.
When two different network security domains need to communicate bilaterally, it is often desirable and necessary to apply different security policies or protocols to data flows in different directions. Preferably, data transfers from a low security domain to a high security domain are subject to fewer security restrictions, while a high security domain has a need to protect its data from the low security domain by carefully configured security protocols. Hence, it is an object of the present invention to implement bilateral communication capable of applying different security policies depending on the direction of the data flow.
It is another object of the present invention to use multiple one-way data links to implement bilateral communication.
It is yet another object of the present invention to separately administer data transfer over each one-way data link in bilateral communication.
It is yet another object of the present invention to apply separate security policy to each one-way data link in bilateral communication.
It is yet another object of the present invention to provide separate data transfer configuration files for each one-way data link in bilateral communication.
It is yet another object of the present invention to provide the capability to apply different security policies, protocols or restrictions to the data transfers in opposite directions in bilateral communication using multiple one-way data links.
It is yet another object of the present invention to provide the capability to enforce different security levels for the data transfers in opposite directions in bilateral communication using multiple one-way data links.
It is yet another object of the present invention to provide the capability to allow different types of data for the data transfers in opposite directions in bilateral communication using multiple one-way data links.
It is yet another object of the present invention to provide the capability to apply different data filtering processes to the data transfers in opposite directions in bilateral communication using multiple one-way data links.
Other objects and advantages of the present invention will become apparent from the following description.